Merge pull request #33663 from asomov

* pr/33663:
  Polish 'Migrate from soon to be deprecate SnakeYAML constructor'
  Migrate from soon to be deprecate SnakeYAML constructor

Closes gh-33663

Author: philwebb

spring-boot-system-tests/spring-boot-image-tests/src/systemTest/java/org/springframework/boot/image/paketo/LayersIndex.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2021 the original author or authors.
+ * Copyright 2012-2023 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -25,6 +25,7 @@
 import java.util.jar.JarFile;
 import java.util.zip.ZipEntry;
 
+import org.yaml.snakeyaml.LoaderOptions;
 import org.yaml.snakeyaml.Yaml;
 import org.yaml.snakeyaml.constructor.Constructor;
 
@@ -45,9 +46,17 @@ static LayersIndex fromArchiveFile(File archiveFile) throws IOException {
 		String indexPath = (archiveFile.getName().endsWith(".war") ? "WEB-INF/layers.idx" : "BOOT-INF/layers.idx");
 		try (JarFile jarFile = new JarFile(archiveFile)) {
 			ZipEntry indexEntry = jarFile.getEntry(indexPath);
-			Yaml yaml = new Yaml(new Constructor(LayersIndex.class));
+			Yaml yaml = new Yaml(new Constructor(LayersIndex.class, getLoaderOptions()));
 			return yaml.load(jarFile.getInputStream(indexEntry));
 		}
 	}
 
+	private static LoaderOptions getLoaderOptions() {
+		LoaderOptions loaderOptions = new LoaderOptions();
+		loaderOptions.setAllowDuplicateKeys(false);
+		loaderOptions.setMaxAliasesForCollections(Integer.MAX_VALUE);
+		loaderOptions.setAllowRecursiveKeys(true);
+		return loaderOptions;
+	}
+
 }